PT-2026-110055

Name of the Vulnerable Software and Affected Versions WpCues Basic Quiz versions prior to 1.6.6 Description The plugin fails to properly sanitize and escape values before incorporating them into a SQL statement. This allows unauthenticated attackers to execute SQL injection attacks, which is a...

PT-2026-110354

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection issue exists within the Inbound Quality Check Pda Interface component. The flaw is located in the WmInQmIController.list function within the...

PT-2026-110350

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection is possible through the manipulation of the goodscode argument within the docheck function of the...

PT-2026-110061

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

PT-2026-110062

Name of the Vulnerable Software and Affected Versions WP Verify API versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the verify parameter before incorporating it into a SQL query. SQL injection is ...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

PT-2026-110352

A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection...

PT-2026-110057

Name of the Vulnerable Software and Affected Versions WP-Partner versions prior to 1.2.2 Description An issue exists where the software fails to sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perform SQL injection, enabling...

PT-2026-110025

Name of the Vulnerable Software and Affected Versions Tcard WP versions prior to 1.8.1 Description The plugin fails to sanitize and escape a parameter used in a SQL statement within an unauthenticated AJAX action. This allows unauthenticated users to execute SQL injection attacks, which involve...

CVE-2026-62117

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

CVE-2026-62031

Unauthenticated SQL Injection in uListing = 2.2.0 versions...

CVE-2026-45440

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

CVE-2026-42722

Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...

CVE-2026-42712

Subscriber SQL Injection in Qode Tours = 3.1.3.2 versions...

CVE-2026-42717

Administrator SQL Injection in Leyka = 3.32.3 versions...

CVE-2026-42633

Subscriber SQL Injection in Events Manager = 7.4.6 versions...

CVE-2026-40800

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...

CVE-2026-108604

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...

CVE-2026-108604 Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...